Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Deploying Deep Security Virtual Appliance(DSVA) in a Guest Introspection and Service Insertion coexisted environment with VMware NSX-T 2.5.0

    • Updated:
    • 2 Mar 2020
    • Product/Version:
    • Deep Security 12.0
    • Platform:
Summary

Know how to deploy DSVA in a Guest Introspection (GI) and Service Insertion(SI) coexisted environment with VMware NSX-T 2.5.0. This is specifically for users who use Anti-malware solution but ony have nVDS Logical switch in the environment, or connecting Management interface to nVDS Logical switch instead of using VSS or VDS when deploy DSVA. 

Details
Public

Please refer to the following deployment prerequisites:

Follow these steps for deployment:

  1. Keep DSM on version 12.0 and remove existing vCenter connector to unregister Partner Service Manager from NSX-T 2.5.0.
    1. Remove the DSVA service deployment plan.
    2. Remove the vCenter connector to force unregister Partner Service Manager from NSX-T 2.5.0 success. Check if the Partner Service has been removed.

  2. Upgrade the DSM server to 12.5 FR-2020-01-27 (12.5.613) or later.
  3. Enable DSVA with Coexist GI+SI function via dsm_c command from DSM server:
    1. Open Command Prompt or PowerShell with local administrator privilege.
    2. Switch working path to DSM default installed folder (ex: C:\Program Files\Trend Micro\Deep Security Manager).
    3. View default value of configuration item: settings.configuration.nsxtAllowNetworkFunctionality

      settings.configuration.nsxtAllowNetworkFunctionality
      >
      .\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true
      Return the value: false

    4. Change above configuration item with value ‘true’.

      >.\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true

  4. Add vCenter connector and NSX-T server from DSM web console. The DSM will register the GI+SI function to NSX-T. Sign on NSX-T web console > System > Service Deployment > CATALOG and it will show both “Endpoint Protection Policy” and “Next Generation Firewall” on Functionality.

  5. Copy the target DSVA packages (ex: dsva-12.0.0-682-small.ovf, dsva-12.0.0-682-small.mf and dsva-12.0.0-682-small.cert) from DSM\temp\Appliance-ESX-12.0.0-682.x86_64 to HTTP server.
    Please note the DSVA packages for GI without build info. To deploy coexisting GI+SI DSVA, select packages with build info.

  6. Modify the DSVA download URL from vCenter connector > NSX configuration.
    For example: http://10.209.66.8:8080/small/dsva-12.0.0-682-small.ovf

    Check if the URL is updated to NSX-T correctly. Click Deploy Service and check the icon from Deployment Specification. Dump the OVF URL for future deployment.

  7. Create Service Deployment plan from NSX-T to deploy DSVA.
    Follow the general Service Deployment procedure same as GI in the Deep Security Help Center.
    There are two required procedures during the deployment:
    1. Select both ens0 and ens2 during the network configuration. The Network could be ESXI standard switch, Distribution Switch (VDS) and Logical Switch (nVDS).

    2. Creating a Service Segment is required. This will bind the Transport Zone used for SI function for coexisting GI+SI DSVA. Please note that the Service Segment is only allowed to be created from standard transport zone. The enhanced Transport zone is not supported.

  8. DSVA connect to nVDS Logical switch and activate success. From vCenter view:

    From NSX-T view:

Premium
Internal
Partner
Rating:
Category:
Configure; Troubleshoot; Deploy
Solution Id:
000244823
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.